cicd: change pypi publishing to trusted publisher

Adding an Equinor user to avoid relying on single indivisuals,
and avoid pwd/token with trusted publishing.

Refs: equinor/ecalc-internal#433

Author: tj098895

.github/workflows/publish.yml

@@ -2,57 +2,63 @@ name: Publish libeCalc package to PyPI
 
 on:
   workflow_call:
-    secrets:
-      PYPI_TOKEN:
-        required: true
-
-  workflow_dispatch: # Trigger manually, if needed
-
-permissions:
-  packages: write
-  contents: read
-  id-token: write
+  workflow_dispatch:
 
 jobs:
   publish:
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/libecalc  # TODO: test
+      #name: pypi
+      #url: https://pypi.org/project/libecalc/
+    permissions:
+      id-token: write  # Required for Trusted Publishing to PyPI, the pypa action uses this
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-        with:
+        #with:
           # Make sure we publish from main branch, not the triggering ref
-          ref: ${{ github.event.repository.default_branch }}
+        #  ref: ${{ github.event.repository.default_branch }}
 
       - name: Setup Python 3.11
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
 
+      # TODO: Change to uv
       - uses: snok/install-poetry@v1
         with:
           version: 1.8.4
           virtualenvs-create: true
 
+      # TODO: Needed? Should have done waaaay earlier, ie. before we are allowed to create a new release
       - name: Check pyproject.toml validity
         run: poetry check --no-interaction
 
-      - name: Cache dependencies
-        id: cache-deps
-        uses: actions/cache@v4
-        with:
-          path: ${{github.workspace}}/.venv
-          key: poetry-${{ hashFiles('**/poetry.lock') }}
-          restore-keys: poetry-
+      # TODO: Needed, we do this to validate? In case sth happened between the lock file was ok and now? withdrawn deps? To build, ie. find packages to allow building, prob. yes, but test to verify!
+#      - name: Cache dependencies
+#        id: cache-deps
+#        uses: actions/cache@v4
+#        with:
+#          path: ${{github.workspace}}/.venv
+#          key: poetry-${{ hashFiles('**/poetry.lock') }}
+#          restore-keys: poetry-
 
-      - name: Install dependencies  # if cache has changed
-        if: steps.cache-deps.cache-hit != 'true'
+#      - name: Install dependencies  # if cache has changed
+#        if: steps.cache-deps.cache-hit != 'true'
+#        run: |
+#          poetry config virtualenvs.in-project true
+#          poetry install --no-interaction
+
+      - name: Build the libecalc package (wheel and sdist by default)
         run: |
-          poetry config virtualenvs.in-project true
-          poetry install --no-interaction
+          poetry build
 
       - name: Publish to PyPI
-        env:
-          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-        run: |
-          poetry config pypi-token.pypi $PYPI_TOKEN
-          poetry publish --build
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+#          attestations: false
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist/
+          clear-previous-versions: true

pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "libecalc"
 # DO_NOT_EDIT: Version number automatically changed in CICD
-version = "10.0.5"  # x-release-please-version
+version = "10.0.6"  # x-release-please-version
 # END_DO_NOT_EDIT
 description = "eCalc™ is a software tool for calculation of energy demand and greenhouse gas (GHG) emissions from oil and gas production and processing."
 keywords = ["energy", "emission", "scientific", "engineering"]